UFW is one of the easiest ways to set up a firewall on Ubuntu. Its full name is Uncomplicated Firewall, and that name fits it well. You can allow SSH, open web ports, block unwanted IP addresses, and check your rules without writing long firewall commands.
In this guide, I will show you how to set up a UFW firewall on Ubuntu 22.04 and Ubuntu 24.04. The same basic commands also work on newer supported Ubuntu releases. We will take one important precaution: allow SSH before enabling UFW, so you do not lock yourself out of a remote server.
Before you start: Keep your current SSH session open. If possible, also keep your hosting provider’s web console ready. A wrong firewall rule can block remote access.
What is UFW?
UFW is Ubuntu’s default firewall configuration tool. It gives you a simple command-line interface for the Linux Netfilter firewall. UFW can manage both IPv4 and IPv6 rules.
A firewall checks network traffic before allowing it to reach a service. For a normal web server, a simple policy works well:
- Block incoming connections by default.
- Allow outgoing connections by default.
- Open only the ports used by SSH, HTTP, HTTPS, or another required service.
UFW is a host firewall. Your cloud provider may also have a network firewall or security group. Check both layers when troubleshooting a blocked port.
Step 1: Check your Ubuntu version
First, confirm the operating-system version:
cat /etc/os-release
Ubuntu 22.04 and 24.04 are long-term support releases. If the server uses Ubuntu 20.04 without Ubuntu Pro coverage, plan an upgrade because its standard security maintenance has ended.
Step 2: Install UFW on Ubuntu
UFW is usually installed on Ubuntu, but it may not be enabled. Update the package list and install it if needed:
sudo apt update sudo apt install ufw
Now check its status:
sudo ufw status verbose
On a fresh setup, you will normally see:
Status: inactive
Do not enable it yet if you are connected through SSH. We will add the SSH rule first.
Step 3: Set the default UFW policies
Use a default-deny policy for incoming traffic and allow normal outgoing traffic:
sudo ufw default deny incoming sudo ufw default allow outgoing
This means a new incoming connection is blocked unless you add a rule for it. The server can still download updates, reach APIs, and make other outgoing connections.
Step 4: Allow SSH before enabling UFW
If SSH uses the default port 22, allow the OpenSSH application profile:
sudo ufw allow OpenSSH
You can also write the port and protocol directly:
sudo ufw allow 22/tcp
If SSH listens on a custom port, replace 2222 with the real port:
sudo ufw allow 2222/tcp
For better control, allow SSH only from a trusted public IP:
sudo ufw allow proto tcp from 203.0.113.10 to any port 22
203.0.113.10 is an example address reserved for documentation. Replace it with your real public IP. Do not use this restriction if your IP changes and you do not have another safe way to access the server.
Before continuing, check the rule:
sudo ufw status numbered
Step 5: Open HTTP and HTTPS ports
A public web server normally needs TCP ports 80 and 443:
sudo ufw allow 80/tcp sudo ufw allow 443/tcp
If Nginx installed UFW application profiles, you can use one command instead:
sudo ufw app list sudo ufw app info 'Nginx Full' sudo ufw allow 'Nginx Full'
The Nginx Full profile opens both HTTP and HTTPS. Always inspect an application profile before allowing it.
Related guide: Secure Nginx with Let’s Encrypt.
Step 6: Enable the UFW firewall
Once SSH and every required service have a rule, enable UFW:
sudo ufw enable
UFW may warn that the command can disrupt SSH connections. Confirm only after checking the SSH rule. Then verify the active firewall:
sudo ufw status verbose sudo ufw status numbered
Open a second terminal and test a new SSH login before closing the original session.
How to allow a port with UFW
The basic format is:
sudo ufw allow PORT/PROTOCOL
For example, allow TCP port 8080:
sudo ufw allow 8080/tcp
You can add a comment so the rule is easier to understand later:
sudo ufw allow 8080/tcp comment 'Application dashboard'
Do not open a port simply because an installation guide mentions it. Confirm which process listens on the port and whether it must be public:
sudo ss -tulpn
Allow an IP address or subnet
To allow one IP address to reach a service:
sudo ufw allow proto tcp from 203.0.113.10 to any port 22
To allow a private subnet to reach MySQL:
sudo ufw allow proto tcp from 192.168.1.0/24 to any port 3306
Opening a database port in UFW is only one part of the setup. The database must also use secure authentication, limited privileges, encrypted connections when needed, and a safe bind address. Avoid exposing MySQL directly to the whole internet.
Allow a port range
UFW uses a colon between the first and last port. You must include the protocol:
sudo ufw allow 35000:35100/tcp
A wide port range increases the exposed surface, so keep it as small as the application allows.
Limit repeated SSH connection attempts
UFW has a simple rate-limit action. It can reduce basic repeated connection attempts:
sudo ufw limit 22/tcp comment 'Rate-limit SSH'
This is not a replacement for SSH keys, disabled root login, strong access controls, or proper monitoring. Read our Linux server hardening guide for the complete setup.
How to deny an IP address
To block one address:
sudo ufw deny from 203.0.113.50
To block a whole network:
sudo ufw deny from 203.0.113.0/24
Rule order matters. UFW checks rules in order, so review the numbered list after adding a broad deny rule.
How to delete UFW rules
The easiest method is to list numbered rules:
sudo ufw status numbered
Then delete the required number:
sudo ufw delete 3
Rule numbers can change after a deletion. Run sudo ufw status numbered again before removing another rule. A generic rule may create separate IPv4 and IPv6 entries, so confirm both are handled.
You can also delete a rule by repeating it with the delete action:
sudo ufw delete allow 8080/tcp
Enable UFW logging
Basic logging helps with troubleshooting and can show blocked traffic:
sudo ufw logging low sudo journalctl -k --grep='UFW' --since today
Higher logging levels can create a lot of data on a busy server. Start with low, monitor disk usage, and send important logs to another system when possible.
UFW and IPv6
UFW can manage IPv4 and IPv6. If IPv6 is active on the server, firewall it instead of disabling it as a shortcut. Check the UFW setting:
grep '^IPV6=' /etc/default/ufw
The normal value is:
IPV6=yes
After changing this file, reload UFW carefully and verify both IPv4 and IPv6 rules.
Disable or reset UFW
To disable the firewall without deleting its saved rules:
sudo ufw disable
To remove user-added rules and return UFW to its installation defaults:
sudo ufw reset
ufw reset is destructive. Review the rules and make sure you know how to rebuild them before confirming.
Common UFW problems
The port is allowed but the service is unreachable
Check whether the service is running and listening on the expected address:
sudo ss -tulpn sudo systemctl status SERVICE_NAME
Also check the cloud firewall, router, application bind address, and DNS.
UFW shows inactive after a reboot
systemctl status ufw sudo ufw status verbose
Read the service logs before forcing changes:
sudo journalctl -u ufw -b
Docker ports do not behave as expected
Container platforms can add their own Netfilter rules. Do not assume that a UFW status screen shows the complete exposure of published container ports. Review Docker’s current firewall documentation and test the port from outside the server.
Frequently asked questions
Does Ubuntu have a firewall by default?
Ubuntu includes Linux Netfilter, and UFW is its default firewall configuration tool. UFW is commonly installed but starts disabled on a fresh system.
How do I check whether UFW is active?
Run sudo ufw status verbose. It shows whether UFW is active, the default policies, and the current rules.
Does UFW block outgoing traffic?
With the common default setup, UFW allows outgoing traffic and blocks incoming traffic that does not match an allow rule. You can change these policies, but restrictive outgoing rules need careful planning.
Should I use UFW and a cloud firewall together?
Yes, they can provide separate layers. Keep their rules documented and consistent so troubleshooting stays manageable.
Official references
Conclusion
To set up a UFW firewall on Ubuntu safely, use a default-deny incoming policy, allow SSH before enabling the firewall, and open only the ports your server needs. Check the numbered rules after every change and test remote access from a second terminal.
UFW is only one layer of server security. Keep Ubuntu updated, use SSH keys, remove unused services, watch your logs, and maintain tested backups. The next step is our complete Linux server hardening checklist.
Comments